某局点WX5540H 远程portal无感知终端点击下线后依旧在线问题处理经验案例

AC结合IMC做远程portal无感知，发现终端点击下线后依旧在线：

查看用户：

配置未发现异常，也没有发现类似版本问题，开启debugging portal all和debugging radius all，手动在终端认证页面点击下线的流程如下：

*Jan  5 15:08:15:424 2024 H3C_AC01 PORTAL/7/EVENT: User-SM[172.X.X.X]: Received accounting-off response.

*Jan  5 15:08:15:424 2024 H3C_AC01 PORTAL/7/FSM: User-SM[172.X.X.X]: Begin to run.

*Jan  5 15:08:15:424 2024 H3C_AC01 PORTAL/7/FSM: User-SM [172.X.X.X]: State changed from Offline_Waiting_Acctoff to Done.

*Jan  5 15:08:15:424 2024 H3C_AC01 PORTAL/7/EVENT: User-SM[172.X.X.X]: Stopped User-SM timer.

*Jan  5 15:08:15:424 2024 H3C_AC01 PORTAL/7/FSM: User-SM[172.X.X.X]: User was destroyed.                       //手动在终端的认证页面点击下线，终端下线成功 

Portal sent 46 bytes of packet: Type=ack_logout(6), ErrCode=0, IP=172.X.X.X                         //下线成功，AC向服务器发送终端下线报文

*Jan  5 15:08:15:425 2024 H3C_AC01 PORTAL/7/PACKET:

[ 11 SESSIONID           ] [  8] [XXXX-XXXX-XXXX]

 此时终端虽然下线了但是wifi并没有断开，终端自身的某些行为又触发了无感知认证的流程：

*Jan  5 15:08:15:542 2024 H3C_AC01 PORTAL/7/MAC-trigger:                                   //触发无感知流程

    MAC-trigger rule:

    InterfaceL3      = WLAN-BSS1/0/103

    InterfaceL2      = WLAN-BSS1/0/103

    VLAN             = 303

    SrcMAC           = XXXX-XXXX-XXXX

    SrcIP            = 172.X.X.X

*Jan  5 15:08:15:542 2024 H3C_AC01 PORTAL/7/MAC-trigger Event: Notify portal daemon new MAC-trigger entry successfully, SrcIP=172.X.X.X, SrcMAC=XXXX-XXXX-XXXX.

*Jan  5 15:08:15:542 2024 H3C_AC01 PORTAL/7/RULE:

 [Inbound] execute full rule match, { MatchRes = [Rule2-Deny] }

IfName = WLAN-BSS1/0/103, PortName = WLAN-BSS1/0/103, Vlan = 303, SrcMAC = XXXX-XXXX-XXXX,

 SrcIP = 172.X.X.X, DstIP = 40.X.X.X

 *Jan  5 15:08:15:543 2024 H3C_AC01 PORTAL/7/MAC-trigger Event: Received MAC overflow event, MAC=XXXX-XXXX-XXXX.    

*Jan  5 15:08:15:544 2024 H3C_AC01 PORTAL/7/EVENT: Success to get ssid by user mac, ssid:Client-Portal, user MAC:XX-XX-XX-XX-XX-XX.

*Jan  5 15:08:15:544 2024 H3C_AC01 PORTAL/7/PACKET:

Portal sent 55 bytes of packet: Type=req_macbind_info(48), ErrCode=0, IP=172.X.X.X             //AC向服务器发送mac绑定查询报文

 *Jan  5 15:08:15:545 2024 H3C_AC01 PORTAL/7/MAC-trigger Event: MAC entry(XXXX-XXXX-XXXX) state changed from DEFAULT to WAIT, user IP = 172.X.X.X.

*Jan  5 15:08:15:546 2024 H3C_AC01 PORTAL/7/EVENT: Success to get info from wlan snooping, vlan:303. mac:XXXX-XXXX-XXXX,userip:172.X.X.X

*Jan  5 15:08:15:546 2024 H3C_AC01 PORTAL/7/EVENT: Success to get ifindex(1926) and vlan(303) from IPCIM, user IP=172.X.X.X,MAC=XXXX-XXXX-XXXX

*Jan  5 15:08:15:546 2024 H3C_AC01 PORTAL/7/PACKET:

Portal received 16 bytes of packet: Type=ack_macbind_info(49), ErrCode=0, IP=172.X.X.X                     // 服务器返回mac查询结果  ErrCode等于0表示该MAC已在服务器绑定，可以走无感知上线

 *Jan  5 15:08:15:546 2024 H3C_AC01 PORTAL/7/MAC-trigger Event: MAC entry(XXXX-XXXX-XXXX) state changed from WAIT to BIND. user IP=172.X.X.X.           //无感知上线成功

现场AC结合IMC做的Portal无感知认证点了下线之后还在线并且还能正常上网是正常的，因为portal虽然下线了但是无线并没有断开，终端的一些行为会再次触发无感知上线并正常上网

所以现场portal无感知场景终端上点击下线不能使终端无法上网，可以从IMC上强制终端下线，IMC上应该可以同时清除无感知表项，终端再次上线就需要认证才能上线